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TRANSMITTAL LETTER 



RE: Applicant (s) 
Assignee : 
Title: 
Serial No. : 
Examiner : 
Docket No. : 



John B. Beavers 
Symantec Corporation 

SYSTEM AND METHOD FOR MANAGING ALERT 
INDICATIONS IN AN ENTERPRISE 

10/082,235 Filed: February 26, 2002 

Venkatanaray Group Art 
Perungavoor Unit : 

SYMC1024 



2132 



Dear Sir: 

Transmitted herewith are the following documents in reply 
to the Examiner's Answer dated August 11, 2006 in the above 
application: 

1. Return receipt postcard; 

2. This Transmittal Letter (2 pages); and 

3. Appellant's Reply Brief (6 pages). 
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Transmittal Letter 



Serial No. 10/082,235 
September 26, 2006 



[x] No additional fees are required. 

\E1 Conditional Petition for Extension of Time: If an 
extension of time is required for timely filing of the 
enclosed documents after all papers filed with this 
transmittal have been considered, Applicant (s) hereby petition 
for such an extension of time. 

H The Commissioner is hereby authorized to charge any 
additional fees required for consideration of the enclosed 
documents, and to credit any overpayment of fees to Deposit 
Account No. 50-0553. 



CERTIFICATE OF MAILING 
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In the United States Patent and Trademark Office 



Applicant (s) : 
Assignee : 
Title : 
Serial No . : 
Examiner : 
Docket No. : 



John B. Beavers 
Symantec Corporation 

SYSTEM AND METHOD FOR MANAGING ALERT INDICATIONS 
IN AN ENTERPRISE 



10/082,235 



Filed: 



February 26, 2 002 



Venkatanaray Perungavoor unit^ 2132 
SYMC1024 



Monterey, CA 
September 26, 2006 



Mail Stop Appeal Brief -Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 



APPELLANT'S REPLY BRIEF 

Dear Sir: 

Pursuant to 37 CFR § 41.41(a) (1), Appellant files this 
Appellant's Reply Brief in Reply to the Examiner's Answer dated 
August 11, 2006. 
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Status of Claims 

Claims 1, 2, 4-10, 12-26 are pending in the application 
and stand rejected. The rejection of Claims 1, 2, 4-10, 12-26 
is hereby appealed. 

Claims 3, 11 have been canceled without prejudice. 
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Grounds of rejection to be reviewed on appeal 

1. Whether Claims 1-2, 4-10, 12-26 are unpatentable under 
35 U.S.C. 102(a) as being anticipated by Curtis et al . 
(6,208, 720) ? 
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Argument 

1. Claims 1-2, 4-10, 12-26 are novel over Curtis et al . 
(6,208,720) 

Claims 1-2, 4-10, 12-26 are allowable over Curtis et al . 
for at least the reasons set forth in the Appellant's Brief 
filed on June 2, 2 0 06. 

With further emphasis on Claims 23-26, Appellant 
respectfully submits that the Examiner's Answer fails to set 
forth a valid anticipation rejection. 

Specifically, MPEP 1207.02 sets forth: 

The examiner's answer is required to include, 
under appropriate headings ... the following items: 

... (9) <Grounds of Rejection. For each ground of 
rejection **>maintained by the examiner and each new 
ground of rejection (if any) , an explanation of the 
ground of rejections 

... (c) For each rejection under 35 U.S.C. 102, the 
examiner's answer **>must< explain why the rejected 
claims are anticipated or not patentable under 3 5 
U.S.C. 102, pointing out where all of the specific 
limitations recited in the rejected claims are found in 
the prior art relied upon in the rejection. (MPEP § 
1207.02, eighth edition, Rev. 3, August 2005, at pages 
1200-28 to 1200-29, emphasis added.) 



Appellant notes that Claim 23 recites: 
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A method of declaring an incident in an enterprise 
comprising : 

providing a number of alert indications containing 
information concerning an incident related to the 
enterprise; and either 

comparing one or more of the alert indications to 
a set of rules, and if a match occurs between the set 
of rules, and the alert indication, declaring an 
incident based on the match, or 

comparing one or more of the alert indications to 
a decision table containing a number of defined alert 
events, remembering each alert indication that matches 
one of the defined alert events, comparing the 
remembered alert indication to correlation data in the 
decision table, and if a match occurs between the 
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remembered alert indication and the correlation data, 
declaring an incident based on the match; or 

if no match occurs between the alert indication 
and the correlation data or the rules set, declare an 
incident if the alert indication meets a defined 
default threshold value; 

displaying to a user an incident ticket for each 
incident declared, the incident ticket including one or 
more user- editable incident tracking rules which 
identify one or more further alert indications for 
association with the incident ticket; 

wherein the user uses a menu on the incident 
ticket to display a tracking update feature for editing 
the user-editable incident tracking rules; and 

wherein the user edits the user-editable incident 
tracking rules to change the one or more further alert 
indications for association with the incident ticket. 
(Emphasis added . ) 

Appellant notes that the only discussion of the rejection 
of Claim 23 in the grounds of rejection in the Examiner's 
Answer is the heading at page 3, which recites: 

Claims 1-2, 4-10, 12-26 are rejected under 35 U.S.C. 
102(a) as being anticipated by U.S. Patent 6208720 Bl 
to Curtis et al . (hereinafter Curtis). 

Accordingly, the Examiner has failed to point out where 
all of the specific limitations recited in Claim 23 are found 
in Curtis et al . and thus the rejection should be overturned. 

In the Response to Argument at pages 6-7 of the Examiner's 
answer, the Examiner states: 

And Curtis discloses an threshold detector which 
operates based on threshold rules which are modifiable, 
i.e., editable, during run-time by the human analyst 
via workstation see Col 3 Ln 19-22 & Col 15 Ln 29-36. 



Applicant notes that at Col. 3, lines 19-22, Curtis et al . 
teaches : 
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In an exemplary embodiment, rules within the database 
of threshold rules may be added or modified 
dynamically, during run- time, by human analysts and by 
a pattern recognition engine which detects new methods 
of fraud. 
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Although Curtis et al . teaches "rules ... may be added or 
modified", the Examiner has failed to callout where Curtis et 
al . teaches or suggests that "the incident ticket including one 
or more user-editable incident tracking rules which identify 
one or more further alert indications for association with the 
incident ticket; wherein the user uses a menu on the incident 
ticket to display a tracking update feature for editing the 
user-editable incident tracking rules' 7 as recited in Claim 23, 
emphasis added. 

Col. 15, lines 29-36 of Curtis et al . , as cited by the 
Examiner, was distinguished in the Appellant's Brief. 

For at least the above reasons, Claim 23 is allowable over 
Curtis et al . Claims 24-26, which depend from Claim 23, are 
allowable for at least the same reasons as Claim 23. 

Conclusion 

For at least the above reasons, Claims 1-2, 4-10, 12-26 
are allowable over Curtis et al . If there are any questions 
relating to the above, please telephone the undersigned 
Attorney for Applicant. 
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I hereby certify that this correspondence is being deposited with the 
United States Postal Service with sufficient postage as first class mail 
in ah envelope addressed to: Commissioner for Patents, P.O. Box 
145( , Alexandria, VA 22313-1450, on September 26, 2006. 



CERTIFICATE OF MAILING 



Serge J. Hodgson I 
Attorney for Appl:. leant (s) 
Reg. No. 40\017 [/ 
Tel . : (831) 655-0880 
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